License Usage by Host over time

[dbecker_AU]

We are using Splunk 6.0.1, and I found a search that generates license usage by host:

index=_internal source=*license_usage.log type=Usage | stats sum(b) as bytes by h | eval MB = round(bytes/1024/1024,1) | fields h MB | rename h as host | sort -MB

What I'd like to do is extend it further to 24 hour spans. The closest I've come is breaking it down by day:

index=_internal source=*license_usage.log type=Usage | eval MB = round(b/1024/1024,1) | timechart per_day(MB) by h span=24h

...but the end always shows today's stats looking much lower because there isn't enough data.

Is there a way to get per_day to start at the current time rather than midnight?

[rmorlen]

You can play around with this. We typically do earliest=@d so that we know the percent we have used today but you should be able to get what you want from this.

index=_internal source=*license* type=Usage | stats sum(b) as BytesUsed max(poolsz) as PoolSize by pool | eval percent = BytesUsed/PoolSize | eval LicenseUsedInGB=round(BytesUsed/1024/1024/1024,2) | eval PoolSizeInGB=PoolSize/1024/1024/1024 | eval PercentUsed=round(percent*100,3) | fields PoolSizeInGB LicenseUsedInGB PercentUsed

You can also look at the latest SoS. The licensing info is accurate and you can tweak the searches form that.

[lukejadamec]

Use the time picker and select the days from midnight to midnight.

[dbecker_AU]

I tried that, but it still divides by calendar day, so today only reports from midnight to the current time.